Death to Malware: Killing Your Funmoods

I’m not a malware hunter by trade, but I have been called on from time to time to do a little extermination.

The “Internet Security” fake antivirus I talked about in my previous post was not the only recent run-in with malware.  A couple of weeks ago, Funmoods hijacked my wife’s browsers.

Funmoods was only a minor pain to remove, but there were no concrete directions to remove this mild nastyware, so we kept running into little things it left behind.

Funmoods is a malicious browser add-on that resets your home page and redirects all of your internet searches to Funmoods.com.  Want something that will kill your fun mood?  This hijacker is a good candidate.  It is time to return the favor.

UPDATE 1/22/2013:  Reports from readers in the comments indicate that changes have been made to the program since I encountered it nearly a year ago.  While following the steps I took to clear the system will help, readers are reporting that Malwarebytes or other malware removal tool is required to completely remove Funmoods.  Malwarebytes is free (a paid version is also available).  I haven’t used the tool, so I can’t endorse it personally, but it appears that it has a good reputation.

It installs itself on any and all browsers on your system, so you will have to repeat the process several times if you have more than one browser installed.  (I’ve included instructions for IE and Chrome, the two browsers on my wife’s system).

The tasks are:

1. Uninstall from Windows.
2. Remove the add-on/extension.
3. Fix your home page setting.
4. Fix your default search setting.

First you need to uninstall it from Windows.  Go To Control Panel >> Programs >> Uninstall a program.  Find Funmoods, and uninstall it.

Then you need to fix each browser.   To remove the add-on, in Internet Explorer, go to Tools, Enable Add-ons, Enable or Disable Add-ons.  Find Funmoods and remove.  In Chrome, uninstall the extension to remove it completely from the browser:

1. Click the wrench icon on the browser toolbar.
2. Click Tools.
3. Select Extensions.
4. Click Uninstall for the extension you’d like to completely remove.

Next you need to reset you home page back to your prior choices.  In IE, click the drop arrow next to the Home icon, and choose Add or Change Home Page.  In Chrome,

1. Click the wrench icon on the browser toolbar.
2. Select Options
3. Click the Basics tab.
4. Set your home page
   Pick the page you’d like to be your home page in the “Home page” section. You can select to use the New Tab page as your home page. To use another page, select “Open this page” and enter the web address of the page you’d like to use.

Then you need to reset your search provider.

Instructions for IE

1. In Internet Explorer, click the arrow to the right of the search box.
   
   Internet Explorer 8 search box
2. Do one of the following:
   • In Internet Explorer 8, click Manage Search Providers.
   • In Internet Explorer 7, click Change Search Defaults.
3. Do one of the following:
   • In Internet Explorer 8, click the search provider you would like to set as the default, click Set as default, and then click Close.
   • In Internet Explorer 7, click the search provider you would like to set as the default, click Set Default, and then click OK.

Set your default search engine in Chrome

1. Click the wrench icon on the browser toolbar.
2. Select Options (Preferences on Mac and Linux; Settingson a Chromebook).
3. Click the Basics tab and find the “Search” section.
4. Select the search engine you want to use from the menu. If the search engine you want to use doesn’t appear in the menu, click Manage search engines.
5. In the Search Engines dialog that appears, select the search engine that you’d like to use from the list.
6. Click the Make Default button that appears in the row.

Funmoods should now be gone and that should put you in a better mood.

It did for me!

UPDATE: There are a number of great tips in the comments below, especially by Shelby and Jean (the response to Jean has some screenshots with it) to deal with some new wrinkles the malware has added. Scrooll down and check them out if the instructions above haven’t fully solved your problem!

Death to viruses, trojans, and spyware! Death to malware!

Jim Adcock makes a living as a SharePoint Administrator, and makes a difference as Vice President of Launch Pad Job Club, an organization in Austin, Texas, whose mission is help people who have lost their jobs to get the skills they need to land their next job, and to help them cope with the interim between jobs. Check out his career-related posts or check out some of the other content on the site.